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REMARKS 

The present application was filed on March 16, 2004 with claims 1-31. Claims 1,5, 15, 16, 
20, 30 and 31 have been amended. No new matter has been added. Claims 1-31 remain pending, 
and claims 1,16 and 31 are the pending independent claims. 

In the outstanding Office Action dated September 7, 2006, the Examiner: (i) rej ected claims 
1-15 under 35 U.S.C §101; (ii) rejected claims 1-5, 8, 9, 11-20, 23, 24 and 26-31 under 35 U.S.C. 
§1 03(a) as being unpatentable over U.S. Patent No. 6,947,933 to Smolsky (hereinafter "Smolsky") in 
view of U.S. Patent Publication No. 2004/0098617 to Sekar et al. (hereinafter "Sekar"); and (iii) 
rejected claims 6, 7, 1 0, 2 1 , 22 and 25 under 3 5 U.S.C. 1 03(a) as being unpatentable over Smolsky in 
view of Sekar and U.S. Patent No. 6,625,585 to MacCuish et al. (hereinafter "MacCuish"). 

With regard to the rejection of claims 1-15 under 35 U.S.C. § 101 , Applicants have amended 
independent claim 1 to produce anoutput and a tangible result. More specifically, independent claim 
1 has been amended to recite that at least one of the one or more clusters is reported as an abnormal 
cluster of objects in the data stream. Accordingly, withdrawal of the rejection to claims 1-15 under 
35 U.S.C. §101 is therefore respectfully requested. 

With regard to the rejection of claims 1-5, 8, 9, 11-20, 23, 24 and 26-31 under 35 U.S.C. 
§ 1 03(a) as being unpatentable over Smolsky in view of Sekar, Applicants respectfully assert that the 
cited combination fails to establish a prima facie case of obviousness under 35 U.S.C. §103(a), as 
specified in M.P.E.P. §2143. 

As set forth therein, M.P f E.P. §2143 states that three requirements must be met to establish a 
prima facie case of obviousness. First, there must.be some suggestion or motivation to combine 
reference teachings. Second, there must be a reasonable expectation of success. Third, the cited 
combination must teach or suggest all the claim limitations. While it is sufficient to show that a 
prima facie case of obviousness has not been established by showing that one of the requirements has 
not been met, Applicants respectfully believe that none of the requirements have been met. 

First, Applicants assert that no motivation or suggestion exists to combine Smolsky and 
Sekar in a manner proposed by the Examiner, or to modify their teachings to meet the claim 
limitations. For at least this reason, a prima facie case of obviousness has not been established. 
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The Federal Circuit has stated that when patentability turns on the question of obviousness, 
the obviousness determination "must be based on objective evidence of record" and that "this 
precedent has been reinforced in myriad decisions, and cannot be dispensed with." In re Lee, 277 
F.3d 1338, 1343 (Fed. Cir. 2002). Moreover, the Federal Circuit has stated that "conclusory 
statements" by an examiner fail to adequately address the factual question of motivation, which is 
material to patentability and cannot be resolved "on subjective belief and unknown authority." Id at 
1343-1344. 

In the Office Action, on page 5, paragraph 2, the Examiner provides the following statement 
to prove motivation to combine Smolsky and Sekar, with emphasis supplied: 

"It would have been obvious ... to use the statistical data of Sekar to determine 
abnormalities in the data of Smolsky. One would have been motivated to do so since 
if an object has a low similarity value in comparison with many objects, then there is 
a high probability of the occurrence of abnormalities." 

Applicants submit that the statement above is based on the type of "subjective belief and 
unknown authority" that the Federal Circuit has indicated provides insufficient support for an 
obviousness rejection. More specifically, the Examiner fails to identify any objective evidence of 
record which supports the proposed combination. 

It is well-settled law that "teachings of references can be combined only if there is some 
suggestion or incentive to do so." ACS Hosp. Sys. v. Montefiore Hosp., 732 F.2d 1572, 1577, 221 
USPQ 929, 933 (Fed. Cir. 1984) (emphasis in original). Moreover, in order to avoid the improper 
use of a hindsight-based obviousness analysis, particular findings must be made as to why one 
skilled in the relevant art, having no knowledge of the claimed invention, would have selected the 
components disclosed by Smolsky and Sekar in the manner claimed {See, e.g., In re Kotzab, 217 
F.3dl365, 1371,55 USPQ2d 1313, 13 17 (Fed. Cir. 2000)). The Examiner's conclusory statements 
do not adequately address the issue of motivation to combine references. "It is improper, in 
determining whether a person of ordinary skill would have been led to this combination of 
references, simply to ' [use] that which the inventor taught against its teacher. "' In re Sang-Su Lee, 
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277 F.3d 1338, 1344 (Fed. Cir. 2002) (quoting W.L. Gore v. Garhck, Inc., 721 F.2d 1540, 1553,220 
USPQ 303, 312-13 (Fed. Cir. 1983)). 

Secondly, Applicants assert that there is no reasonable expectation of success in achieving the 
present invention through a combination of Smolsky and Sekar. For at least this reason, a prima 
facie case of obviousness has not been established. Applicants do not believe that Smolsky and 
Sekar are combinable since it is not clear how one would combine them. Smolsky relates to 
similarity of documents while Sekar relates to anomalies in a series of network packets. Again, no 
guidance was provided in the Office Action as to how the references can be combined to achieve the 
present invention. However, even if combined, for the sake of argument, they would not achieve the 
techniques of the claimed invention. 

Lastly, the collective teaching of Smolsky and Sekar fails to suggest or render obvious at least 
the elements of independent claims 1 , 1 6 and 3 1 of the present invention. For at least this reason, a 
prima facie case of obviousness has not been established. 

Independent claim 1 recites a method for monitoring abnormalities in a data stream. A 
plurality of objects in the data stream are received. One or more clusters are created from the 
plurality of objects. At least a portion of each of the one or more clusters comprise statistical data 
representative of the respective cluster. It is determined from the statistical data whether each of the 
one or more clusters is abnormal when compared to defined statistics. At least one of the one or 
more clusters is reported as an abnormal cluster of objects in the data stream. Independent claims 16 
and 3 1 recite additional aspects of the present invention having similar limitations. 

Smolsky discloses a technique for determining when documents stored in a digital format in a 
data processing system are similar. The Examiner asserts that Smolsky discloses the reception of a 
plurality of chunks and the creation of clusters from the chunks. However, the Examiner admits that 
Smolsky fails disclose a determination of whether one or more abnormalities exist in the data stream. 
The Examiner cites Sekar to remedy the deficiencies of Smolsky. 

Sekar discloses a method for network intrusion detection through the detection of an 
anomaly. However, while Sekar provides network packet anomaly detection, it fails to disclose a 
determination of whether a cluster of data objects is abnormal when the statistical data of that cluster 
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is compared to a predefined value as recited in amended independent claims 1,16 and 31. 

Dependent claims 2-5, 8, 9, 11-15, 17-20, 23,24 and 26-30 are patentable at least by virtue of 
their dependency from independent claims 1 and 16. Dependent claims 2-5, 8, 9, 11-15, 17-20 23, 
24 and 26-30 also recite patentable subject matter in their own right. For example, the combined 
teaching of Smolsky and Sekar fails to disclose a determination of whether a similarity value is 
greater than a user-defined threshold when determine when to add an object to a closest cluster, as 
recited in claims 4 and 19. Additionally, the combined teaching of Smolsky and Sekar fails to 
disclose the steps of determining clusters (not documents as the Examiner cites in Smolsky) present 
at a first time and not a second time, and determining clusters (not chunks as the Examiner cites in 
Smolsky) with fewer than a user-defined number of objects, as recited in claims 5 and 20. 
Accordingly, withdrawal of the rejection to claims 1-5, 8, 9, 1 1-20, 23, 24 and 26-3 1 under 35 U.S.C. 
§ 103(a) is therefore respectfully requested. 

With regard to the rejection of claims 6, 7, 10, 21, 22 and 25 under 35 U.S.C. 103(a) as being 
unpatentable over Smolsky in view of Sekar and MacCuish, Applicants respectfully assert that 
MacCuish fails to remedy the deficiencies of Smolsky and Sekar provided above, and thus such 
claims are patentable at least by virtue of their dependency from independent claims 1 and 16. 
Claims 6, 7, 1 0, 21, 22 and 25 also recite patentable subject matter in their own right. Accordingly, 
withdrawal of the rejection to claims 6, 7, 10, 21, 22 and 25 under 35 U.S.C. § 103(a) is therefore 
respectfully requested. 
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In view of the above, Applicants believe that claims 1 -3 1 are in condition for allowance, and 
respectfully request withdrawal of the §1 03(a) rejections. 



Respectfully submitted, 

Date: December 7, 2006 Robert W. Griffith 
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